fix(scim): submit only the changed setting; move settings option lists to a constants module

Also stubs the SCIM section in the SSO settings test, which has no QueryClient.

Co-Authored-By: Claude Fable 5.1 <noreply@anthropic.com>

Author: waleedlatif1

apps/sim/ee/scim/components/scim-section.tsx

@@ -34,6 +34,15 @@ import {
   usePermissionGroups,
 } from '@/ee/access-control/hooks/permission-groups'
 import { SettingRow } from '@/ee/components/setting-row'
+import {
+  CREDENTIAL_EXPIRY_OPTIONS,
+  type CredentialExpiry,
+  type MappingTargetKind,
+  PERMISSION_OPTIONS,
+  SETTING_TOGGLES,
+  TARGET_KIND_OPTIONS,
+  type WorkspacePermission,
+} from '@/ee/scim/constants'
 import {
   useConfigureScimConnection,
   useDeleteScimGroupMapping,
@@ -50,51 +59,6 @@ interface ScimSectionProps {
   organizationId: string
 }
 
-type MappingTargetKind = ScimGroupMappingView['targetKind']
-type WorkspacePermission = NonNullable<ScimGroupMappingView['permissionType']>
-
-const TARGET_KIND_OPTIONS = [
-  { value: 'permission_group', label: 'Permission group' },
-  { value: 'workspace', label: 'Workspace' },
-  { value: 'org_role', label: 'Organization admin' },
-] as const
-
-const PERMISSION_OPTIONS = [
-  { value: 'read', label: 'Read' },
-  { value: 'write', label: 'Write' },
-  { value: 'admin', label: 'Admin' },
-] as const
-
-const SETTING_TOGGLES = [
-  {
-    key: 'lockManualMembership',
-    label: 'Lock managed membership',
-    description:
-      'Refuse invitations, role changes, and manual grants for members the directory provisions. The next sync would revert them anyway.',
-  },
-  {
-    key: 'disableJit',
-    label: 'Disable just-in-time provisioning',
-    description:
-      'Refuse membership for someone signing in with SSO who the directory never provisioned. The directory becomes the only way in.',
-  },
-  {
-    key: 'autoMapPermissionGroupsByName',
-    label: 'Match permission groups by name',
-    description:
-      'When a pushed group has the same name as one of your permission groups, map them automatically. Nothing is created.',
-  },
-] as const
-
-/** Credential lifetimes offered at issue time; `never` matches what Okta and Entra expect by default. */
-const CREDENTIAL_EXPIRY_OPTIONS = [
-  { value: 'never', label: 'Never expires' },
-  { value: '90', label: 'Expires in 90 days' },
-  { value: '365', label: 'Expires in 1 year' },
-] as const
-
-type CredentialExpiry = (typeof CREDENTIAL_EXPIRY_OPTIONS)[number]['value']
-
 const RELATIVE_TIME = new Intl.RelativeTimeFormat('en', { numeric: 'auto' })
 
 /** Renders "3 minutes ago" for the activity list and credential rows. */
@@ -367,10 +331,8 @@ function ConnectionDetails({ organizationId, connection }: ConnectionDetailsProp
 
   async function handleToggleSetting(key: (typeof SETTING_TOGGLES)[number]['key'], value: boolean) {
     try {
-      await configure.mutateAsync({
-        organizationId,
-        settings: { ...connection.settings, [key]: value },
-      })
+      /** Only the changed key is sent; the server merges it, so a concurrent edit elsewhere is not reverted. */
+      await configure.mutateAsync({ organizationId, settings: { [key]: value } })
     } catch (error) {
       toast.error(getErrorMessage(error, 'Failed to update setting'))
     }

apps/sim/ee/scim/constants.ts

@@ -0,0 +1,48 @@
+import type { ScimGroupMappingView } from '@/lib/api/contracts/organization-scim'
+
+/** Option lists and setting descriptions for the directory provisioning settings section. */
+
+export type MappingTargetKind = ScimGroupMappingView['targetKind']
+export type WorkspacePermission = NonNullable<ScimGroupMappingView['permissionType']>
+
+export const TARGET_KIND_OPTIONS = [
+  { value: 'permission_group', label: 'Permission group' },
+  { value: 'workspace', label: 'Workspace' },
+  { value: 'org_role', label: 'Organization admin' },
+] as const
+
+export const PERMISSION_OPTIONS = [
+  { value: 'read', label: 'Read' },
+  { value: 'write', label: 'Write' },
+  { value: 'admin', label: 'Admin' },
+] as const
+
+export const SETTING_TOGGLES = [
+  {
+    key: 'lockManualMembership',
+    label: 'Lock managed membership',
+    description:
+      'Refuse invitations, role changes, and manual grants for members the directory provisions. The next sync would revert them anyway.',
+  },
+  {
+    key: 'disableJit',
+    label: 'Disable just-in-time provisioning',
+    description:
+      'Refuse membership for someone signing in with SSO who the directory never provisioned. The directory becomes the only way in.',
+  },
+  {
+    key: 'autoMapPermissionGroupsByName',
+    label: 'Match permission groups by name',
+    description:
+      'When a pushed group has the same name as one of your permission groups, map them automatically. Nothing is created.',
+  },
+] as const
+
+/** Credential lifetimes offered at issue time; `never` matches what Okta and Entra expect by default. */
+export const CREDENTIAL_EXPIRY_OPTIONS = [
+  { value: 'never', label: 'Never expires' },
+  { value: '90', label: 'Expires in 90 days' },
+  { value: '365', label: 'Expires in 1 year' },
+] as const
+
+export type CredentialExpiry = (typeof CREDENTIAL_EXPIRY_OPTIONS)[number]['value']

apps/sim/ee/sso/components/sso-settings.test.tsx

@@ -90,6 +90,11 @@ vi.mock('@/ee/sso/components/verified-domains-section', () => ({
   VerifiedDomainsSection: () => <div />,
 }))
 
+/** Directory provisioning has its own React Query hooks and its own tests; here it is a sibling section. */
+vi.mock('@/ee/scim/components/scim-section', () => ({
+  ScimSection: () => <div />,
+}))
+
 // Surface the real Save/Update action so submit paths are reachable from tests.
 vi.mock('@/components/settings/save-discard-actions', () => ({
   saveDiscardActions: ({ saveLabel, onSave }: { saveLabel?: string; onSave?: () => void }) => [